From mboxrd@z Thu Jan 1 00:00:00 1970 From: Keir Fraser Subject: Re: PATCH: Set close-on-exec flag for QEMU disks Date: Mon, 05 Mar 2007 13:25:23 +0000 Message-ID: References: <20070302214037.GC4598@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20070302214037.GC4598@redhat.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: "Daniel P. Berrange" , xen-devel@lists.xensource.com List-Id: xen-devel@lists.xenproject.org On 2/3/07 21:40, "Daniel P. Berrange" wrote: > QEMU does not currently set the close-on-exec flag after opening its virtual > disk images. This causes problems when it later runs the /etc/xen/qemu-ifup > script because the file descriptors get propagated to networking commands > like brctl / ifconfig. The SELinux policy quite rightly does not allow the > networking scripts to access the virtual disk images, so these inherited > file descriptors for AVC denials to be logged. > > The attached patch modifies all the QEMU disk driver backends to make sure > the close-on-exec flag is turned on It would be nicer to implement an open_cloexec() function in e.g., vl.c to do the open() and fcntl() in one go and in one place. There are lots of uses of open() throughout the qemu sources and the patch only fixes up a subset of them -- is this correct? -- Keir